diff --git a/SPECS/python-tqdm/CVE-2024-34062.patch b/SPECS/python-tqdm/CVE-2024-34062.patch new file mode 100644 index 00000000000..6d98c0dc550 --- /dev/null +++ b/SPECS/python-tqdm/CVE-2024-34062.patch @@ -0,0 +1,63 @@ +From 16eed9fc5bdc5e6de477a5329a3e6bd13548554a Mon Sep 17 00:00:00 2001 +From: Kanishk Bansal +Date: Thu, 6 Feb 2025 19:06:45 +0000 +Subject: [PATCH] Address CVE-2024-34062 +Upstream Patch Reference https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316 + +--- + tqdm/cli.py | 33 ++++++++++++++++++++++----------- + 1 file changed, 22 insertions(+), 11 deletions(-) + +diff --git a/tqdm/cli.py b/tqdm/cli.py +index 1223d49..7284f28 100644 +--- a/tqdm/cli.py ++++ b/tqdm/cli.py +@@ -21,23 +21,34 @@ def cast(val, typ): + return cast(val, t) + except TqdmTypeError: + pass +- raise TqdmTypeError(val + ' : ' + typ) ++ raise TqdmTypeError(f"{val} : {typ}") + + # sys.stderr.write('\ndebug | `val:type`: `' + val + ':' + typ + '`.\n') + if typ == 'bool': + if (val == 'True') or (val == ''): + return True +- elif val == 'False': ++ if val == 'False': + return False +- else: +- raise TqdmTypeError(val + ' : ' + typ) +- try: +- return eval(typ + '("' + val + '")') +- except Exception: +- if typ == 'chr': +- return chr(ord(eval('"' + val + '"'))).encode() +- else: +- raise TqdmTypeError(val + ' : ' + typ) ++ raise TqdmTypeError(val + ' : ' + typ) ++ if typ == 'chr': ++ if len(val) == 1: ++ return val.encode() ++ if re.match(r"^\\\w+$", val): ++ return eval(f'"{val}"').encode() ++ raise TqdmTypeError(f"{val} : {typ}") ++ if typ == 'str': ++ return val ++ if typ == 'int': ++ try: ++ return int(val) ++ except ValueError as exc: ++ raise TqdmTypeError(f"{val} : {typ}") from exc ++ if typ == 'float': ++ try: ++ return float(val) ++ except ValueError as exc: ++ raise TqdmTypeError(f"{val} : {typ}") from exc ++ raise TqdmTypeError(f"{val} : {typ}") + + + def posix_pipe(fin, fout, delim=b'\\n', buf_size=256, +-- +2.43.0 + diff --git a/SPECS/python-tqdm/python-tqdm.spec b/SPECS/python-tqdm/python-tqdm.spec index 23bbc2006a4..225624da876 100644 --- a/SPECS/python-tqdm/python-tqdm.spec +++ b/SPECS/python-tqdm/python-tqdm.spec @@ -7,14 +7,14 @@ with "tqdm(iterable)", and you are done! Summary: Fast, Extensible Progress Meter Name: python-%{srcname} Version: 4.66.2 -Release: 1%{?dist} +Release: 2%{?dist} License: MPLv2.0 AND MIT Vendor: Microsoft Corporation Distribution: Azure Linux URL: https://github.com/tqdm/tqdm Source0: %{pypi_source} BuildArch: noarch - +Patch0: CVE-2024-34062.patch %description %{_description} %package -n python3-%{srcname} @@ -40,7 +40,7 @@ Python 3 version. %prep export SETUPTOOLS_SCM_PRETEND_VERSION=%{version} -%autosetup -n %{srcname}-%{version} +%autosetup -p1 -n %{srcname}-%{version} chmod -x tqdm/completion.sh # https://github.com/tqdm/tqdm/pull/1292 @@ -90,6 +90,9 @@ pip3 install iniconfig \ %changelog +* Fri Feb 07 2025 Kanishk Bansal - 4.66.2-2 +- Patch CVE-2024-34062 + * Tue Mar 26 2024 Henry Li - 4.66.2-1 - Upgrade version to v4.66.2 - Modify Source0